regex101: PCRE (Legacy) Match Workspace

Regular Expression

Group:\s+Security\s+ID:\s+.*?\\([^ ]+)

New

<13>Jan 09 12:33:50 TESTSRV1 AgentDevice=WindowsLog    AgentLogFile=Security    PluginVersion=7.2.4.86    Source=Microsoft-Windows-Security-Auditing    Computer=corp.devnet.com    OriginatingComputer=TESTSRV1    User=    Domain=    EventID=4755    EventIDCode=4755    EventType=8    EventCategory=13826    RecordNumber=1244048130    TimeGenerated=1483983229    TimeWritten=1483983229    Level=0    Keywords=0    Task=0    Opcode=0    Message=A security-enabled universal group was changed.  Subject:  Security ID:  CORP\TESTUSR1  Account Name:  TESTUSR1  Account Domain:  CORP  Logon ID:  0x220f7a57  Group:  Security ID:  CORP\VirtualUsers  Group Name:  VirtualUsers  Group Domain:  CORP  Changed Attributes:  SAM Account Name: -  SID History:  -  Additional Information:  Privileges:  -

<13>Jan 09 12:33:50 TESTSRV1 AgentDevice=WindowsLog    AgentLogFile=Security    PluginVersion=7.2.4.86    Source=Microsoft-Windows-Security-Auditing    Computer=corp.devnet.com    OriginatingComputer=TESTSRV1    User=    Domain=    EventID=4755    EventIDCode=4755    EventType=8    EventCategory=13826    RecordNumber=1244048130    TimeGenerated=1483983229    TimeWritten=1483983229    Level=0    Keywords=0    Task=0    Opcode=0    Message=A security-enabled universal group was changed.  Subject:  Security ID:  CORP\TESTUSR1  Account Name:  TESTUSR1  Account Domain:  CORP  Logon ID:  0x220f7a57  Group:  Security ID:  CORP\VM Admins  Group Name:  VM Admins  Group Domain:  CORP  Changed Attributes:  SAM Account Name: -  SID History:  -  Additional Information:  Privileges:  -